[QSA-1022262]
Security Update Bundle

Qlustar Security Advisory 1022262

October 22nd, 2026

Summary:

A Qlustar security update bundle is a cumulative update of packages that are taken from upstream Debian/Ubuntu without modification. Only packages that are used in a typical HPC/Storage cluster installation are mentioned in Qlustar Security Advisories. Other non-HPC related updates also enter the Qlustar repository, but their functionality is not separately verified by the Qlustar team. To track these updates subscribe to the general security mailing lists of Debian/Ubuntu and/or AlmaLinux.

Package(s)       : see upstream description of individual package
Qlustar releases : 13, 14
Affected versions: All versions prior to this update
Vulnerability    : see upstream description of individual package
Problem type     : see upstream description of individual package
Qlustar-specific : no
CVE Id(s)        : see descriptions below

This update includes several security related package updates from Debian/Ubuntu and AlmaLinux. The following list provides references to the upstream security report of the corresponding packages. You can view the original upstream advisory by clicking on the corresponding title.

Relevant to Qlustar 13 and/or 14 – Ubuntu

If an advisory applies only to Qlustar 13 or 14, it is noted in its description.

PHP vulnerabilities

It was discovered that PHP incorrectly handled out-of-memory conditions while processing requests. A remote attacker could use this issue to execute arbitrary code. (CVE-2026-109618)

It was discovered that PHP incorrectly managed internal request state across worker reuse. A remote attacker could use this issue to execute arbitrary code. (CVE-2026-109619)

XZ Utils vulnerability

It was discovered that XZ Utils incorrectly handled certain memory allocation failures when reinitializing decoders for specific compressed file formats. An attacker could possibly use this issue to trigger an invalid memory write, resulting in a denial of service or arbitrary code execution.

PHP vulnerabilities

It was discovered that PHP did not properly validate the size of MySQL server packets in the mysqlnd driver. A malicious server could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2025-1218)

It was discovered that PHP incorrectly handled response buffer sizes in the SOAP HTTP client. A malicious server could possibly use this issue to cause PHP to crash, resulting in a denial of service, or execute arbitrary code. (CVE-2025-14181)

It was discovered that PHP incorrectly handled certain TAR archive headers in the Phar extension. An attacker could possibly use this issue to inject arbitrary files into a crafted archive. (CVE-2026-6103)

It was discovered that PHP did not limit recursion depth when parsing certain SOAP requests. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2026-91765)

It was discovered that PHP incorrectly handled authentication headers when following HTTP redirects. A remote attacker could possibly use this issue to obtain sensitive information. (CVE-2026-91766)

It was discovered that PHP incorrectly handled wildcard names in TLS server certificates. A malicious server could possibly use this issue to cause PHP to crash, resulting in a denial of service. (CVE-2026-91767)

It was discovered that PHP incorrectly validated IPv6 client addresses in the FastCGI client access check. A remote attacker could possibly use this issue to bypass access restrictions. (CVE-2026-91768)

It was discovered that PHP incorrectly performed TLS peer name verification. A remote attacker could possibly use this issue to impersonate a trusted server. (CVE-2026-91769)

It was discovered that PHP incorrectly handled certain stream filter options. An attacker could possibly use this issue to obtain sensitive information. (CVE-2026-92842)

It was discovered that PHP incorrectly handled empty Location headers when following HTTP redirects. A malicious server could possibly use this issue to redirect the client to an unintended location. (CVE-2026-93682)

AlmaLinux 8.10 security updates

Please check the AlmaLinux Errata site for details about AlmaLinux 8 updates that entered this release (everything from October 16th until October 21st).

Update instructions:

The problem can be corrected by updating your system to the following or more recent package versions:

For Qlustar 14

qlustar-module-core-noble-amd64-14.1       14.1.16-b589f1663
qlustar-module-core-centos8-amd64-14.1     14.1.16-b589f1663

For Qlustar 13

qlustar-module-core-jammy-amd64-13.4       13.4.15-b588f1662

Special Update instructions:

In addition to the steps described in the general Qlustar Update Instructions these updates require the following:

• Spack migration With the release of the HPC Core Stack 02/26, spack was also updated to version 1.1.1. If you haven’t yet migrated your spack database to version 8, login on a cluster node as a user with Spack admin rights (usually user softadm or anybody in the group softadm) and execute

  # spack reindex
  

  Note that after this, older Spack versions will no longer be able to read the database. However, a backup is created in case a revert is needed.

• Please note that we no longer provide 13.x AlmaLinux 8 modules for Qlustar 13. If you want to use AlmaLinux 8 under Qlustar 13, please switch to the 14.x image modules and create a corresponding chroot for it.